Known Vulnerabilities for products from Concretecms
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Concretecms".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-8435 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVe... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8434 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMul... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8433 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan().... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8432 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). T... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8428 json | Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the ... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8427 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFav... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8426 json | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_re... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8421 json | Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_pag... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8417 json | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8416 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavori... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8415 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/associa... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8414 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8413 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/desig... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8412 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cach... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8411 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delet... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8410 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delet... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8409 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. ... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8353 json | Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject a... | Not Provided | 2026-05-22 | 2026-07-23 |
| CVE-2026-8350 json | Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privile... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-8347 json | Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. T... | Not Provided | 2026-05-22 | 2026-07-23 |